Method and system for preventing the downloading and execution of executable objects

Abstract

A method for selectively preventing the downloading and execution of undesired Executable Objects in a computer includes analyzing a header of a an Executable Object which is detected at a gateway, determining the resources of a computer that the Executable Object needs to utilize and comparing the resources of the computer that the Executable Object needs to utilize with a user's Security Policy representing the resources, or a combination of resources, that the user allows or does not allow an executable object to utilize within its network. The Executable Object is allowed to pass through the gateway and to reach the computer which has initiated its downloading, if the resources of the computer that the Executable Object needs to utilize are included in the list of the resources allowed for use by the Security Policy. The Executable Object is prevented from passing through the gateway, thereby preventing it from reaching the computer which has initiated its downloading, if the resources of the computer that the Executable Object needs to utilize are included in the list of the resources prohibited for use by the Security Policy.

What is claimed is:  
     
       1. A method for selectively preventing the downloading and execution of undesired Executable Objects in a computer, comprising: 
       (a) providing one or more Control Centers, each connected to one or more gateways located between a LAN and an external computer communication network;  
       (b) providing means coupled to each of said gateways, to detect Executable Objects reaching said gateway to analyze the header of each of said Executable Objects, and to determine the resources of the computer that the Executable Object needs to utilize;  
       (c) providing means coupled to each of said gateways, to store a user's Security Policy representing the resources, or combination of resources, that the user allows or does not allow an Executable Object to utilize within its LAN, wherein the Security Policy is received from and/or stored in each of said one or more Control Centers;  
       (d) when an Executable Object is detected at the gateway:  
       1. analyzing the header of said Executable Object;  
       2. determining the resources of the computer that the Executable Object needs to utilize;  
       3. comparing the resources of the computer that the Executable Object needs to utilize with the Security Policy and;  
       (i) if the resources of the computer that the Executable Object needs to utilize are included in the list of the resources allowed for use by the Security Policy, allowing the Executable Object to pass through the gateway and to reach the computer which has initiated its downloading; and  
       (ii) if the resources of the computer that the Executable Object needs to utilize are included in the list of the resources prohibited for use by the Security Policy, preventing the Executable Object from passing through the gateway, thereby preventing it from reaching the computer which has initiated its downloading.  
     
     
       2. A method according to  claim 1 , further comprising, in addition to the means of  claim 1 (d)3: 
       (iii) means for alerting the Security Officers that a given type of Executable Object has entered the gateway; and  
       (iv) means for storing information pertaining to a given Executable Object according to the Security Policy.  
     
     
       3. A method according to  claim 2  further comprising the steps of: 
       (4) when an undesirable executable object is detected at a gateway, providing an identifying value therefrom, and notifying all gateways thereof, and  
       (5) providing memory means and suitable identity verification means, coupled to each gateway, to identify undesirable executable objects already analyzed by another gateway, and from preventing it from passing the gateway.  
     
     
       4. A method according to  claim 1 , wherein the Executable Object is selected from Java Applets, Active-X, OCX, Win32 Executables, DLLs, or the like executable objects. 
     
     
       5. A method according to  claim 4  further comprising the steps of: 
       (4) when an undesirable executable object is detected at a gateway, providing an identifying value therefrom, and notifying all gateways thereof, and  
       (5) providing memory means and suitable identity verification means, coupled to each gateway, to identify undesirable executable objects already analyzed by another gateway, and from preventing it from passing the gateway.  
     
     
       6. A method according to  claim 1 , further comprising the steps of: 
       (4) when an undesirable Executable Object is detected at a gateway, providing an identifying value therefrom, and notifying all gateways thereof; and  
       (5) providing memory means and suitable identity verification means, coupled to each gateway, to identify undesirable Executable Objects already analyzed by another gateway, and from preventing it from passing the gateway.  
     
     
       7. A method according to  claim 6 , wherein a checksum or the like procedure is carried out on the Executable Object, to generate a substantially unique identification thereof. 
     
     
       8. A method according to  claim 1 , wherein when more than one Control Centers are provided, Security Policies are disseminated from one main Control Center to the remaining Control Centers, and wherein each Control Center, in turn, controls the operation of the gateways connected to it. 
     
     
       9. A method according to  claim 8  wherein each patrol center and each group of gateways is provided with its own individual security policy, which may be the same or different from the security policy received from the main control center. 
     
     
       10. A method according to  claim 1 , wherein each Control Center and each group of gateways is provided with its own individual Security Policy, which may be the same or different from the Security Policy received from the main Control Center. 
     
     
       11. A method according to  claim 10 , wherein each subordinate Control Center may add additional limitations to the Security Policy received from the main Control Center, by the addition of resources to the list of those the use of which is not allowed, but it may not remove limitations from the list of limited resources contained in the Security Policy distributed by the main Control Center. 
     
     
       12. A computer system comprising one or more LANs, each LAN being connected to an outside computer or computer network through one or more gateways, comprising: 
       (a) one or more Control Centers, each Control Centers being connected to one or more gateways located between a LAN and an external computer communication network;  
       (b) means coupled to each of said gateways, to detect Executable Objects reaching said gateway, to analyze the header of each of said Executable Objects, and to determine the resources of the computer that the Executable Object needs to utilize;  
       (c) means coupled to each of said gateways, to store a user's Security Policy representing the resources, or combination of resources, that the user allows or does not allow an Executable Object to utilize within its LAN, wherein the Security Policy is received from and/or stored in each of said one or more Control Centers;  
       (d) means, provided at, or coupled to, each gateway:  
       1. to analyze the header of when an Executable Object which is detected at the gateway;  
       2. to determine the resources of the computer that the Executable Object needs to utilize;  
       3. to compare the resources of the computer that the Executable Object needs to utilize with the Security Policy and;  
       (i) means to allow the Executable Object to pass through the gateway and to reach the computer which has initiated its downloading, if the resources of the computer that the Executable Object needs to utilize are included in the list of the resources allowed for use by the Security Policy; and  
       (ii) means for preventing the Executable Object from passing through the gateway, thereby preventing it from reaching the computer which has initiated its downloading, if the resources of the computer that the Executable Object needs to utilize are included in the list of the resources prohibited for use by the Security Policy.  
     
     
       13. A computer system according to  claim 12 , further comprising, in addition to the means of  claim 9 (d)3: 
       (iii) means for alerting the Security Officers that a given type of Executable Object has entered the gateway; and  
       (iv) means for storing information pertaining to a given Executable Object according to the Security Policy.  
     
     
       14. A computer recording medium including computer executable code for selectively preventing the downloading and execution of undesired Executable Objects in a computer, said recording medium comprising: 
       code for analyzing a header of an Executable Object;  
       code for determining resources of the computer that the Executable Object needs to utilize;  
       code for comparing the resources of the computer that the Executable Object needs to utilize with a user's Security Policy representing the resources, or a combination of resources, that the user allows or does not allow an executable object to utilize within its network, wherein  
       if the resources of the computer that the Executable Object needs to utilize are included in the list of the resources allowed for use by the Security Policy, allowing the Executable Object to pass through a gateway and to reach the computer which has initiated its downloading, and  
       if the resources of the computer that the Executable Object needs to utilize are included in the list of the resources prohibited for use by the Security Policy, preventing the Executable Object from passing through a gateway, thereby preventing it from reaching the computer which has initiated its downloading.  
     
     
       15. A method for selectively preventing the downloading and execution of undesired Executable Objects in a computer, comprising: 
       analyzing a header of a an Executable Object which is detected at a gateway;  
       determining the resources of a computer that the Executable Object needs to utilize;  
       comparing the resources of the computer that the Executable Object needs to utilize with a user's Security Policy representing the resources, or a combination of resources, that the user allows or does not allow an executable object to utilize within its network, wherein  
       the Executable Object is allowed to pass through the gateway and to reach the computer which has initiated its downloading, if the resources of the computer that the Executable Object needs to utilize are included in the list of the resources allowed for use by the Security Policy, and  
       the Executable Object is prevented from passing through the gateway, thereby preventing it from reaching the computer which has initiated its downloading, if the resources of the computer that the Executable Object needs to utilize are included in the list of the resources prohibited for use by the Security Policy.  
     
     
       16. A computer recording medium including computer executable code for selectively preventing the downloading and execution of undesired Executable Objects in a computer, said recording medium comprising: 
       code for analyzing a header of an Executable Object;  
       code for determining resources of the computer that the Executable Object needs to utilize;  
       code for comparing the resources of the computer that the Executable Object needs to utilize with a user's Security Policy representing the resources, or a combination of resources, that the user allows or does not allow an executable object to utilize within its network, wherein  
       if the resources of the computer that the Executable Object needs to utilize are included in the list of the resources prohibited for use by the Security Policy, preventing the Executable Object from passing through a gateway, thereby preventing it from reaching the computer which has initiated its downloading.  
     
     
       17. A method for selectively preventing the downloading and execution of undesired Executable Objects in a computer, comprising: 
       analyzing a header of a an Executable Object which is detected at a gateway;  
       determining the resources of a computer that the Executable Object needs to utilize;  
       comparing the resources of the computer that the Executable Object needs to utilize with a user's Security Policy representing the resources, or a combination of resources, that the user allows or does not allow an executable object to utilize within its network, wherein  
       the Executable Object is prevented from passing through the gateway, thereby preventing it from reaching the computer which has initiated its downloading, if the resources of the computer that the Executable Object needs to utilize are included in the list of the resources prohibited for use by the Security Policy.